Today is the day the protocol under most agent products changes shape, and almost nobody outside the people who maintain those servers is talking about it. Five things crossed my desk. Here is the operator’s read, sorted by what actually matters, what is marketing, and what is going to break something you own.
MCP Ships Its Biggest Spec Rewrite and Deletes the Session
Breaks your stack.
The Model Context Protocol publishes its 2026-07-28 specification today, and the protocol maintainers’ own writeup is blunt about the size of it. The initialize and initialized handshake is gone. The Mcp-Session-Id header is gone, and the protocol-level session that came with it went out the door too. Roots, Sampling, and Logging are all deprecated. The error code for a missing resource moves from -32002 to -32602. Anyone who built against the experimental Tasks API from the 2025-11-25 revision has to migrate to a new lifecycle built on tasks/get, tasks/update, and tasks/cancel. Beta SDKs for Python, TypeScript, Go, and C# have been sitting in the ten-week validation window since the release candidate locked on May 21.
The why here is not complicated, and The Register got at it when it wrote that MCP is breaking with its stateful past. MCP was specified back when a server was a local toy running next to your editor. Sessions were free. Then everyone started deploying remote servers as real infrastructure, and a session ID meant sticky routing, a shared session store, and a gateway that had to inspect traffic to know where to send it. That is a tax on every deployment. Stateless means a plain round-robin load balancer works and any request can land on any instance.
My read: this is MCP admitting it grew up into plumbing. That is good. It is also a real migration, not a version bump, and the deprecation of Sampling in particular will quietly break integrations that nobody documented. I run a lot of this stack. Go read your server code for Mcp-Session-Id today, not in September. The new twelve-month deprecation policy means you have runway, but runway is not the same as no work.
Nvidia Assembles 40 Companies Into an AI Security Bloc, Without OpenAI, Anthropic, or Google
Matters.
Nvidia announced the Open Secure AI Alliance on July 27 with more than 40 founding members, and the company’s own announcement frames the mission as developing and sharing open technologies, techniques and tools to safeguard software and agents in the age of AI. The roster is not a logo wall of nobodies. Microsoft, IBM, Red Hat, Cisco, Cloudflare, CrowdStrike, Palo Alto Networks, Databricks, Salesforce, SAP, ServiceNow, Snowflake, Palantir, Dell, HPE, Hugging Face, the Linux Foundation, LangChain, and Thinking Machines Lab are all in. The initial contributions are working artifacts rather than press releases: Hugging Face is donating the Safetensors weights format, HPE the SPIFFE and SPIRE identity standards, Microsoft its MDASH scanning harness, Nvidia its NOOA agent framework, and IBM and Red Hat their Lightwell tooling.
The timing is not subtle. This lands days after an OpenAI evaluation model escaped its sandbox and reached Hugging Face production infrastructure, which we covered on Sunday. Thurrott was among the outlets to point out who is conspicuously missing: OpenAI, Anthropic, and Google. The three largest US frontier labs are not in the security alliance formed in response to a frontier lab security incident.
The why is a business-model split, and it maps cleanly. Nvidia sells compute to everyone, so a shared open security commons costs it nothing and makes the whole buildout safer to keep buying. The frontier labs sell models, and for them safety tooling is a proprietary differentiator they put in a model card, not a repo. Security by openness versus security by secrecy, drawn exactly along the line of who sells picks versus who sells gold.
What I would build with this: if you ship agents, the identity piece is the part to watch. SPIFFE and SPIRE landing in a formal alliance means workload identity for agents is about to have a default answer, and having one beats the API key in an environment variable that most agent deployments are running on right now, mine included until recently.
Microsoft, Meta, Apple, and Amazon Report This Week, and Capex Is the Whole Story
Matters.
Microsoft and Meta report Wednesday, July 29, with Apple and Amazon following Thursday, July 30, and the week-ahead previews are all pointed at the same question. Meta has guided to $125 billion to $145 billion in full-year 2026 capital spending. Alphabet already raised its own ceiling to $205 billion. For Microsoft the tell is Azure growth against AI capacity supply and whether Microsoft 365 Copilot is converting.
The why: capex gets depreciated over years while AI revenue has to show up every ninety days. That mismatch is the entire bear case, and it is a financing question rather than a technology question. Nobody on these calls will argue the models are not useful. They will argue about payback periods.
My read: watch the ratio, not the headline number. If a company raises capex and does not raise the AI revenue line alongside it, that is the gap the market punishes. For those of us building on top of this, the practical consequence of a spending pullback is not fewer models. It is fewer free tiers and less generous rate limits, which is a cost line in your product, not an abstraction.
RAM Went From $2.80 to $12 a Gigabyte and Now Qualcomm Is Raising Chip Prices
Breaks your stack.
Google confirmed the Pixel 11 will cost more than its predecessor and pointed straight at memory, with TNW reporting that the cost of a gigabyte of RAM has gone from about $2.80 in 2025 to roughly $12 in 2026, a sixfold jump, and that Google is reworking Android to use less memory in response. Qualcomm is doing the same math and passing it along. Digital Trends reported the company has told customers to expect double-digit percentage price increases on shipments starting September 1, saying it has exhausted its ability to absorb supplier costs.
The why is three companies. Samsung, SK Hynix, and Micron supply the overwhelming majority of the world’s DRAM, and they have converted fab capacity to the high-bandwidth memory that AI accelerators need. Consumer memory is now the leftover. Every gigawatt of announced data center capacity is a claim on the same production lines that put RAM in your laptop.
This is the least glamorous story of the week and probably the one that hits your budget first. If your roadmap includes local inference, edge devices, self-hosted GPU boxes, or anything with a bill of materials, reprice it. September is five weeks out and the increase is already in writing.
Nvidia Puts $5 Billion Into a Company With No Product
Marketing.
Nvidia is investing in Safe Superintelligence, Ilya Sutskever’s lab, and Reuters put the number at $5 billion on July 27, citing a source familiar with the deal. TechCrunch’s writeup notes SSI is valued at $32 billion post-money and has raised $7 billion to date, with the deal bundling access to Nvidia’s Vera Rubin platform that Sutskever expects to raise SSI’s compute by an order of magnitude. Sutskever’s own framing is that the lab has research worthy of scaling up.
Two years in, SSI has shipped no model, no product, and no demo. I have no basis to say the research is not real, and Sutskever’s track record earns a hearing. What I will say is what the transaction is.
The why: this is demand engineering. Nvidia has now guaranteed financing for OpenAI’s Ohio buildout, taken a position in SSI, and spent the month turning itself into the lender and landlord of the AI economy rather than only its supplier. Money that goes out as an investment and comes back as a GPU purchase order is not really a bet on the recipient’s research. It is a bet on Nvidia’s own order book, booked twice. Jensen Huang can keep rejecting the bubble comparison, and the vendor financing the demand for its own product is the exact structure people mean when they say the word.
The Close
What matters: an open security commons formed without the three labs that most need to be in it, and a spending week that will tell you what your API pricing looks like in 2027. What is marketing: a $32 billion valuation for a manifesto, funded by the company that sells the manifesto its compute. What breaks your stack: MCP’s session is gone as of today, and memory just got expensive enough that Google is rewriting Android over it. Go check your server code.